A single phone call unravels MGM Resorts' cybersecurity

© Reuters. A single phone call unravels MGM Resorts' cybersecurity

A mere phone call was enough to set off a cybersecurity calamity for Las Vegas' MGM Resorts, shedding light on vishing as an increasingly potent threat.

This form of social engineering involves calling victims to extract sensitive information and system credentials, which can be further used as a launch pad to set up more complicated attacks.

In this case, it appears that the hackers found an employee’s information on LinkedIn and impersonated them in a call to MGM’s IT help desk to obtain credentials to access and infect the systems," according to Vox.

The alleged culprit behind this incident is the hacking group Scattered Spider, specialists in ‘vishing’ - voice phishing.

pic.twitter.com/nxIweGInsB

— MGM Resorts (@MGMResortsIntl) September 11, 2023

What happened?

MGM Resorts revealed last week that a ‘cybersecurity issue’ had disrupted several of its systems, forcing the company into manual mode to sustain operations.

Guests experienced hours-long queues for physical room keys and received handwritten receipts for casino winnings.

MGM Resorts has not officially commented beyond vague Twitter posts acknowledging a "cybersecurity issue".

To mitigate the attack, MGM shut down some of its internal networks, resulting in disruption of services for up to five consecutive days.

During this period, another Las Vegas Casino, Ceasers also paid a ransom of $15 million to a cybercrime group that managed to steal social security numbers and licence information from several of its customers from the company's database.

Furthermore, sources have also confirmed to CNBC that a similar ransom demand was made to MGM as well.

Read more on Proactive Investors AU

Disclaimer